Fixes T9669. Two issues:
- We were using repositoryPHIDs instead of blueprintPHIDs for the list of allowed blueprints. Use the correct value.
- We weren't enforcing allowedBlueprintPHIDs fully correctly. We did require an authorization, so the net effect was correct in nearly all cases, but we could have selected from too large a pool in the case where the application itself was doing the authorization (e.g., from the command line).